Penetration Testing

Penetration testing, also called pen testing or ethical hacking, is the practice of testing a computer system, network or web application to find security vulnerabilities that an attacker could exploit. Penetration testing can be automated with software applications or performed manually. Either way, the process involves gathering information about the target before the test, identifying possible entry points, attempting to break in -- either virtually or for real -- and reporting back the findings. 

The main objective of penetration testing is to identify security weaknesses. Penetration testing can also be used to test an organization's security policy, its adherence to compliance requirements, its employees' security awareness and the organization's ability to identify and respond to security incidents.

Typically, the information about security weaknesses that are identified or exploited through pen testing is aggregated and provided to the organization's IT and network system managers, enabling them to make strategic decisions and prioritize remediation efforts.

Penetration tests are also sometimes called white hat attacks because in a pen test, the good guys are attempting to break in.

Purpose of penetration testing

The primary goal of a pen test is to identify weak spots in an organization's security posture, as well as measure the compliance of its security policy, test the staff's awareness of security issues and determine whether -- and how -- the organization would be subject to security disasters.

A penetration test can also highlight weaknesses in a company's security policies. For instance, although a security policy focuses on preventing and detecting an attack on an enterprise's systems, that policy may not include a process to expel a hacker.

The reports generated by a penetration test provide the feedback needed for an organization to prioritize the investments it plans to make in its security. These reports can also help application developers create more secure apps. If developers understand how hackers broke into the applications they helped develop, the intention is to motivate developers to enhance their education around security so they won't make the same or similar errors in the future.

How often you should perform penetration testing

Organizations should perform pen testing regularly -- ideally, once a year -- to ensure more consistent network security and IT management. In addition to conducting regulatory-mandated analysis and assessments, penetration tests may also be run whenever an organization:

• adds new network infrastructure or applications;
• makes significant upgrades or modifications to its applications or infrastructure;
• establishes offices in new locations;
• applies security patches; or
• modifies end-user policies.

However, because penetration testing is not one-size-fits-all, when a company should engage in pen testing also depends on several other factors, including:

• The size of the company. Companies with a larger presence online have more attack vectors and, therefore, are more-attractive targets for hackers.
• Penetration tests can be costly, so a company with a smaller budget might not be able to conduct them annually. An organization with a smaller budget might only be able to conduct a penetration test once every two years while a company with a larger budget can do penetration testing once a year.
• Regulations and compliance. Organizations in certain industries are required by law to perform certain security tasks, including pen testing.
• A company whose infrastructure is in the cloud might not be allowed to test the cloud provider's infrastructure. However, the provider may be conducting pen tests itself.

Penetration testing efforts should be tailored to the individual organization as well as the industry it operates in and should include follow-up and evaluation tasks so that the vulnerabilities found in the latest pen test are note reported in following tests.

Penetration testing tools

Pen testers often use automated tools to uncover standard application vulnerabilities. Penetration tools scan code in order to identity malicious code in applications that could result in a security breach. Pen testing tools examine data encryption techniques and can identify hard-coded values, such as usernames and passwords, to verify security vulnerabilities in the system.

Penetration testing tools should:

• be easy to deploy, configure and use;
• scan a system easily;
• categorize vulnerabilities based on severity, i.e., those that need to be fixed immediately;
• be capable of automating the verification of vulnerabilities;
• re-verify previous exploits; and
• generate detailed vulnerability reports and logs

Many of the most popular penetration testing tools are free or open-source software; this gives pen testers the ability to modify or otherwise adapt the code for their own needs. Some of the most widely used free or open-source pen testing tools include:

• The Metasploit Project is an open-source project owned by the security company Rapid7, which licenses full-featured versions of the Metasploit software. It collects popular penetration testing tools that can be used on servers, online-based applications and networks. Metasploit can be used to uncover security issues, to verify vulnerability mitigations and to manage security processes.
• Nmap, short for "network mapper," is a port scanner that scans systems and networks for vulnerabilities linked to open ports. Nmap is directed to the IP address or addresses on which the system or network to be scanned is located and then tests those systems for open ports; in addition, Nmap can be used to monitor host or service uptime and map network attack surfaces.
• Wireshark is a tool for profiling network traffic and for analyzing network packets. Wireshark enables organizations to see the smaller details of the network activities taking place in their networks. This penetration tool is a network analyzer/network sniffer/network protocol analyzer that assesses vulnerabilities in network traffic in real time. Wireshark is often used to scrutinize the details of network traffic at various levels.
• John the Ripper incorporates different password crackers into one package, automatically identifies different types of password hashes and determines a customizable cracker. Pen testers typically use the tool to launch attacks to find password weaknesses in systems or databases.

Penetration testers use many of the same tools that black hat hackers use, in part because those tools are well-documented and widely available, but also because it helps the pen testers to better understand how those tools can be wielded against their organizations.

Penetration test strategies

One important aspect of any penetration testing program is defining the scope within which the pen testers must operate. Usually, the scope defines what systems, locations, techniques and tools can be used in a penetration test. Limiting the scope of the penetration test helps focus team members -- and defenders -- on the systems over which the organization has control.

For example, if penetration testers gain access to a system because an employee left a password in plain sight, that reveals bad security practices on the part of the employee; it gives the pen testing team no insights into the security of the application that was compromised.

Here are several of the main pen test strategies used by security professionals:

Targeted testing is performed by the organization's IT team and the penetration testing team working together. It's sometimes referred to as a "lights turned on" approach because everyone can see the test being carried out.

External testing targets a company's externally visible servers or devices including domain name servers, email servers, web servers or firewalls. The objective is to find out if an outside attacker can get in and how far they can get in once they've gained access.

Internal testing mimics an inside attack behind the firewall by an authorized user with standard access privileges. This kind of test is useful for estimating how much damage a disgruntled employee could cause.

Blind testing simulates the actions and procedures of a real attacker by severely limiting the information given to the person or team performing the test beforehand. Typically, the pen testers may only be given the name of the company. Because this type of test can require a considerable amount of time for reconnaissance, it can be expensive.

Double-blind testing takes the blind test and carries it a step further. In this type of pen test, only one or two people within the organization might be aware a test is being conducted. Double-blind tests can be useful for testing an organization's security monitoring and incident identification as well as its response procedures.

Black box testing is basically the same as blind testing, but the tester receives no information before the test takes place. Rather, the pen testers must find their own way into the system.

White box testing provides the penetration testers information about the target network before they start their work. This information can include such details as IP addresses, network infrastructure schematics and the protocols used plus the source code.

Pen Testing as a Service (PTaaS) provides information technology (IT) professionals with the resources they need to conduct and act upon point-in-time and continuous penetration tests.

Using different pen testing strategies helps pen testing teams focus on the desired systems and gain insight into the types of attacks that are most threatening.